General
-
Target
202f3713a360b2e2b5e5c196baf25c19
-
Size
1014KB
-
Sample
210901-zdnxb3blvx
-
MD5
202f3713a360b2e2b5e5c196baf25c19
-
SHA1
225c938bb3993c15e5920c921b896d25adc12b4e
-
SHA256
3b7b846373c9e626c33e2561a6ff5515a67f25dc089f6e62711e792572105a17
-
SHA512
ecaee0e710c32f010b34b2e6776298ba3767e0b1db5125a6657751994e99b05807c42cc2efa743bd8a3332d1a7a017cd837265409b8775395574f8d6608c173b
Malware Config
Extracted
https://kmsauto.us/1/fix.txt
Extracted
https://ia601409.us.archive.org/7/items/fixmix_fix_4348843584358435/fixmix_fix_4348843584358435.txt
Targets
-
-
Target
202f3713a360b2e2b5e5c196baf25c19
-
Size
1014KB
-
MD5
202f3713a360b2e2b5e5c196baf25c19
-
SHA1
225c938bb3993c15e5920c921b896d25adc12b4e
-
SHA256
3b7b846373c9e626c33e2561a6ff5515a67f25dc089f6e62711e792572105a17
-
SHA512
ecaee0e710c32f010b34b2e6776298ba3767e0b1db5125a6657751994e99b05807c42cc2efa743bd8a3332d1a7a017cd837265409b8775395574f8d6608c173b
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies Windows Defender Real-time Protection settings
-
suricata: ET MALWARE Win32/Delf.BLL Variant CnC Activity (Inbound)
suricata: ET MALWARE Win32/Delf.BLL Variant CnC Activity (Inbound)
-
suricata: ET MALWARE Win32/Delf.BLL Variant CnC Activity (Outbound)
suricata: ET MALWARE Win32/Delf.BLL Variant CnC Activity (Outbound)
-
ModiLoader First Stage
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of SetThreadContext
-